loader2 & hello world 2
(c) 04/10/2005 by abu <
[email protected]>
http://sunkone.cjb.net/psp/
This is a new program loader for Sony PSP firmware 2.0.
It is based on Toc2rta's h.bin loader and exploit.
Differences:
- After the program code, stack is repaired and the TIFF thread continues,
no more system crash/hang. You can also start background threads.
- Completely new loader code. Wallpaper PNG contains all of the program loader.
Only file name is placed in TIF because framebuffer can't contain filenames
(every 4th byte must be zero). All this is in order to minimize stack corruption.
Source code for generating PNG's from assembly is included.
- Completely new TIFF image to do the overflow. It contains only what is
necessary (150 bytes). Perl code for producing the TIFF is included.
Instead of using BitsPerSample tag, we use Compression tag. It is
processed earlier in libtiff, makes stack repairing easier.
- Load address changed to 0x08556000. The old address must have contained
some VSH data because clean exit wasn't possible with it. Because of this,
the old h.bin programs aren't compatible, and file name was changed to "a.bin".
- The hello world program shows how to kill some system threads to get
solid screen without flicker.
Source code for everything is included. It was tested on Linux.
Libpng is required for PNG generation.
How to install:
1) remove any old exploit images from /PSP/PHOTO/
2) copy loader2.png to /PSP/PHOTO/
3) set loader2.png as wallpaper
4) copy loader2.tif to /PSP/PHOTO/
5) place a.bin in memorystick root /
6) go to photo menu --> the loader code will run ms0:/a.bin
